Cybersecurity articles tagged #Fortinet on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/gunra-ransomware-exploits-fortinet-flaws-and-bypasses-mfahttps://runtimerebel.com/blog/gunra-ransomware-exploits-fortinet-flaws-and-bypasses-mfaGunra ransomware targets critical infrastructure using leaked Conti code, old Fortinet vulnerabilities, and MFA bypass techniques.Wed, 12 Aug 2026 09:05:47 GMTRansomwareFortinetCredential TheftCritical Infrastructurehttps://runtimerebel.com/blog/hackers-breach-polish-chp-plant-via-private-apn-and-teltonika-routerhttps://runtimerebel.com/blog/hackers-breach-polish-chp-plant-via-private-apn-and-teltonika-routerAttackers breached a Polish combined heat and power plant via a private APN, shutting down a steam turbine and water treatment system.Tue, 11 Aug 2026 08:44:42 GMTCritical InfrastructureRansomwareFortinetTeltonikaSiemenshttps://runtimerebel.com/blog/cve-2025-68686-fortinet-fortios-patch-bypass-for-post-exploit-persistencehttps://runtimerebel.com/blog/cve-2025-68686-fortinet-fortios-patch-bypass-for-post-exploit-persistenceCISA warns of active exploitation of CVE-2025-68686 in Fortinet FortiOS, allowing attackers to bypass a patch for post-exploit persistence and expose sensitive data.Fri, 31 Jul 2026 10:43:21 GMTCVE-2025-68686FortinetFortiosInformation ExposurePatch BypassPost ExploitationCISA KEVCWE-200https://runtimerebel.com/blog/lynx-ransomware-linked-to-massive-fortibleed-credential-thefthttps://runtimerebel.com/blog/lynx-ransomware-linked-to-massive-fortibleed-credential-theftThreat actors behind Lynx and INC ransomware leverage FortiBleed campaign to harvest over 440,000 Fortinet VPN credentials via CVE-2023-48788 exploits.Thu, 02 Jul 2026 07:36:16 GMTLynx RansomwareINC RansomwareCVE-2023-48788FortinetCredential TheftFortiClient EMShttps://runtimerebel.com/blog/fortinet-fortibleed-campaign-86000-vpn-credentials-stolenhttps://runtimerebel.com/blog/fortinet-fortibleed-campaign-86000-vpn-credentials-stolenFortinet addresses the FortiBleed campaign involving 86,000+ confirmed working credentials. Technical analysis and mitigation steps for security professionals.Mon, 22 Jun 2026 10:16:29 GMTFortinetFortiosFortiBleedCredential HarvestingVPN Securityhttps://runtimerebel.com/blog/fortibleed-73932-fortigate-systems-exposed-credential-leak-analysishttps://runtimerebel.com/blog/fortibleed-73932-fortigate-systems-exposed-credential-leak-analysisAnalysis of the FortiBleed campaign, detailing the exposure of administrative and VPN credentials for over 73,000 Fortinet FortiGate firewalls and critical mitigation…Sat, 20 Jun 2026 05:36:54 GMTFortiBleedFortiGateFortinetCredential ExposureFirewall SecurityNetwork Securityhttps://runtimerebel.com/blog/fortibleed-data-leak-securing-fortinet-vpns-against-exposurehttps://runtimerebel.com/blog/fortibleed-data-leak-securing-fortinet-vpns-against-exposureCISA warns organizations after 74,000 Fortinet VPN credentials were leaked online. Learn how to mitigate the FortiBleed threat and secure your network.Fri, 19 Jun 2026 09:44:30 GMTFortinetFortiGateVPNCVE-2018-13379CISACredential Leakhttps://runtimerebel.com/blog/fortibleed-73000-fortinet-vpn-credentials-exposedhttps://runtimerebel.com/blog/fortibleed-73000-fortinet-vpn-credentials-exposedFortiBleed leak compromises Fortinet and FortiGate VPN credentials for over 73,000 firewall URLs globally, posing significant access risks.Thu, 18 Jun 2026 01:08:29 GMTFortiBleedFortinetFortiGateVPNCredentialsData Leakhttps://runtimerebel.com/blog/credential-harvesting-heist-compromises-30k-fortinet-deviceshttps://runtimerebel.com/blog/credential-harvesting-heist-compromises-30k-fortinet-devicesA widespread credential harvesting campaign has compromised over 30,000 Fortinet devices across 200 countries, enabling unauthorized access for threat actors.Wed, 17 Jun 2026 13:29:46 GMTFortinetCredential HarvestingCyberattackData Breachhttps://runtimerebel.com/blog/fortinet-fortisandbox-attackers-exploit-cve-2026-39813-39808-25089https://runtimerebel.com/blog/fortinet-fortisandbox-attackers-exploit-cve-2026-39813-39808-25089Critical Fortinet FortiSandbox vulnerabilities (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089) are under active exploitation. Patch immediately.Tue, 16 Jun 2026 13:57:36 GMTFortinetFortiSandboxCVE-2026-39813CVE-2026-39808CVE-2026-25089Path TraversalActive Exploitationhttps://runtimerebel.com/blog/fortisandbox-rce-via-cve-2024-23108-and-cve-2024-23109-patch-nowhttps://runtimerebel.com/blog/fortisandbox-rce-via-cve-2024-23108-and-cve-2024-23109-patch-nowUnauthenticated attackers are exploiting critical command injection flaws in Fortinet FortiSandbox to achieve RCE. Apply security updates immediately.Tue, 16 Jun 2026 09:58:32 GMTCVE-2024-23108CVE-2024-23109FortinetFortiSandboxRCECommand Injectionhttps://runtimerebel.com/blog/fortisiem-rce-via-cve-2024-23108-technical-mitigation-guidehttps://runtimerebel.com/blog/fortisiem-rce-via-cve-2024-23108-technical-mitigation-guideAnalysis of critical RCE vulnerabilities CVE-2024-23108 and CVE-2024-23109 in Fortinet FortiSIEM, including detection methods and remediation steps.Mon, 15 Jun 2026 05:54:57 GMTCVE-2024-23108CVE-2024-23109FortinetFortiSIEMRCEhttps://runtimerebel.com/blog/fortisandbox-command-injection-cve-2026-25089-critical-vendor-patcheshttps://runtimerebel.com/blog/fortisandbox-command-injection-cve-2026-25089-critical-vendor-patchesCritical patches from Fortinet, Ivanti, and SAP address vulnerabilities including CVE-2026-25089 (FortiSandbox command injection), enabling RCE and info disclosure.Wed, 10 Jun 2026 17:14:48 GMTCVE-2026-25089FortiSandboxFortinetIvantiSAPCommand InjectionRCEVulnerability Managementhttps://runtimerebel.com/blog/cve-2026-35616-forticlient-ems-exploit-delivers-ekz-infostealerhttps://runtimerebel.com/blog/cve-2026-35616-forticlient-ems-exploit-delivers-ekz-infostealerAttackers are actively exploiting CVE-2026-35616, an authentication bypass in FortiClient EMS, to deploy the EKZ infostealer. Protect your organization now.Thu, 28 May 2026 20:53:31 GMTCVE-2026-35616FortiClient EMSEKZ InfostealerAuthentication BypassCredential StealerFortinethttps://runtimerebel.com/blog/cve-2023-48788-critical-forticlient-ems-rce-under-active-exploitationhttps://runtimerebel.com/blog/cve-2023-48788-critical-forticlient-ems-rce-under-active-exploitationExploitation of CVE-2023-48788 in FortiClient EMS allows unauthenticated remote code execution. Administrators must patch to version 7.2.3 or 7.0.11 immediately.Thu, 28 May 2026 13:26:51 GMTFortinetCVE-2023-48788RCEFortiClient EMSSQL Injectionhttps://runtimerebel.com/blog/ivanti-fortinet-and-n8n-disclose-critical-rce-and-auth-bypass-flawshttps://runtimerebel.com/blog/ivanti-fortinet-and-n8n-disclose-critical-rce-and-auth-bypass-flawsIvanti, Fortinet, n8n, and SAP release urgent security patches for critical vulnerabilities including CVE-2026-5444 and CVE-2026-8043. Update systems now.Mon, 18 May 2026 13:23:34 GMTCVE-2026-8043CVE-2026-5444IvantiFortinetN8nRCEhttps://runtimerebel.com/blog/sap-cve-2026-27681-critical-sql-injection-vulnerability-patch-guidancehttps://runtimerebel.com/blog/sap-cve-2026-27681-critical-sql-injection-vulnerability-patch-guidanceApril Patch Tuesday addresses a critical 9.9 CVSS SQL injection vulnerability in SAP Business Warehouse and updates for Microsoft, Adobe, and Fortinet.Wed, 15 Apr 2026 16:28:18 GMTCVE-2026-27681SAPPatch TuesdaySQL InjectionMicrosoftFortinethttps://runtimerebel.com/blog/cve-2024-21762-and-ivanti-flaws-edge-gateway-scanning-escalateshttps://runtimerebel.com/blog/cve-2024-21762-and-ivanti-flaws-edge-gateway-scanning-escalatesTechnical analysis of ongoing scanning activity targeting Ivanti and Fortinet SSL-VPN gateways. Learn to detect exploits and apply critical mitigations.Wed, 15 Apr 2026 08:41:41 GMTIvantiFortinetSsl VpnCVE-2024-21762CVE-2023-46805RCEhttps://runtimerebel.com/blog/cisa-kev-update-fortinet-forticlient-ems-cve-2026-21643-under-attackhttps://runtimerebel.com/blog/cisa-kev-update-fortinet-forticlient-ems-cve-2026-21643-under-attackCISA adds six flaws to the KEV catalog, including a critical unauthenticated SQL injection in Fortinet FortiClient EMS (CVE-2026-21643). Patch immediately.Tue, 14 Apr 2026 08:40:46 GMTFortinetCVE-2026-21643CISA KEVSQL InjectionFortiClient EMShttps://runtimerebel.com/blog/cisa-kev-update-exchange-server-adobe-ms-windows-exploitshttps://runtimerebel.com/blog/cisa-kev-update-exchange-server-adobe-ms-windows-exploitsCISA adds seven vulnerabilities, including critical Microsoft Exchange Server deserialization, to its Known Exploited Vulnerabilities Catalog, urging immediate…Tue, 14 Apr 2026 00:47:03 GMTCVE-2012-1854CVE-2020-9715CVE-2023-21529CVE-2023-36424CVE-2025-60710CVE-2026-21643CVE-2026-34621Microsoft Exchange ServerAdobe AcrobatMicrosoft WindowsFortinetCISAKEV CatalogDeserializationUse After FreeSQL Injectionhttps://runtimerebel.com/blog/cve-2026-35616-fortinet-forticlient-ems-vulnerability-kev-alerthttps://runtimerebel.com/blog/cve-2026-35616-fortinet-forticlient-ems-vulnerability-kev-alertCISA adds CVE-2026-35616 affecting Fortinet FortiClient EMS to its Known Exploited Vulnerabilities catalog. Learn how to mitigate this access control flaw.Mon, 06 Apr 2026 16:23:16 GMTCVE-2026-35616FortinetFortiClient EMSKEVAccess Controlhttps://runtimerebel.com/blog/forticlient-ems-rce-via-cve-2023-48788-patch-guidancehttps://runtimerebel.com/blog/forticlient-ems-rce-via-cve-2023-48788-patch-guidanceCISA mandates federal agencies patch the critical FortiClient EMS SQL injection flaw, CVE-2023-48788, which allows unauthenticated remote code execution.Mon, 06 Apr 2026 16:21:26 GMTCVE-2023-48788FortinetCISARCESQL Injectionhttps://runtimerebel.com/blog/chrome-zero-day-and-fortinet-exploits-weekly-threat-intelligencehttps://runtimerebel.com/blog/chrome-zero-day-and-fortinet-exploits-weekly-threat-intelligenceIntelligence analysis of the latest Chrome zero-day, Fortinet vulnerabilities, and the Axios security breach, including technical remediation for SOC teams.Mon, 06 Apr 2026 16:20:58 GMTGoogle ChromeFortinetAxios HackParagon SpywareZero-Dayhttps://runtimerebel.com/blog/forticlient-ems-rce-via-cve-2026-35616-mitigation-guidehttps://runtimerebel.com/blog/forticlient-ems-rce-via-cve-2026-35616-mitigation-guideFortinet releases emergency patches for CVE-2026-35616, a critical SQL injection flaw in FortiClient EMS exploited to achieve unauthenticated RCE.Sun, 05 Apr 2026 20:12:25 GMTCVE-2026-35616FortinetFortiClient EMSRCEActive Exploitationhttps://runtimerebel.com/blog/cve-2026-35616-critical-forticlient-ems-api-bypass-exploitedhttps://runtimerebel.com/blog/cve-2026-35616-critical-forticlient-ems-api-bypass-exploitedFortinet releases out-of-band patches for CVE-2026-35616, a critical API access bypass in FortiClient EMS enabling unauthenticated privilege escalation.Sun, 05 Apr 2026 08:18:00 GMTCVE-2026-35616FortiClient EMSFortinetPrivilege Escalationhttps://runtimerebel.com/blog/fortinet-forticlient-ems-critical-sqli-flaw-under-active-exploitationhttps://runtimerebel.com/blog/fortinet-forticlient-ems-critical-sqli-flaw-under-active-exploitationCritical SQL injection in FortiClient EMS allows unauthenticated remote code execution. Active exploitation detected, immediate patching required.Tue, 31 Mar 2026 12:31:11 GMTFortinetFortiClient EMSSQL InjectionRCEExploitationhttps://runtimerebel.com/blog/cve-2023-48788-forticlient-ems-rce-via-sql-injection-exploithttps://runtimerebel.com/blog/cve-2023-48788-forticlient-ems-rce-via-sql-injection-exploitExploitation of a critical RCE vulnerability (CVE-2023-48788) in Fortinet FortiClient EMS has been confirmed. Learn how to detect and mitigate this threat.Mon, 30 Mar 2026 08:40:09 GMTCVE-2023-48788FortinetFortiClient EMSRCESQL Injectionhttps://runtimerebel.com/blog/siemens-ruggedcom-ape1808-critical-authentication-bypass-patch-nowhttps://runtimerebel.com/blog/siemens-ruggedcom-ape1808-critical-authentication-bypass-patch-nowSecurity alert for Siemens RUGGEDCOM APE1808. Multiple vulnerabilities, including a 9.8 CVSS authentication bypass, affect ICS environments. Patch immediately.Thu, 12 Mar 2026 20:16:11 GMTCVE-2026-24858SiemensRUGGEDCOMFortinetIndustrial Control SystemsICS Securityhttps://runtimerebel.com/blog/fortinet-ivanti-and-intel-patch-high-severity-rce-vulnerabilitieshttps://runtimerebel.com/blog/fortinet-ivanti-and-intel-patch-high-severity-rce-vulnerabilitiesFortinet, Ivanti, and Intel have issued patches for high-severity vulnerabilities in FortiClient, ICS gateways, and various hardware drivers.Wed, 11 Mar 2026 12:20:19 GMTCVE-2024-36513CVE-2024-37375FortinetIvantiIntelRCEhttps://runtimerebel.com/blog/fortigate-ngfw-exploitation-leads-to-service-account-credential-thefthttps://runtimerebel.com/blog/fortigate-ngfw-exploitation-leads-to-service-account-credential-theftThreat actors are exploiting FortiGate devices to extract configuration files and steal service account credentials, facilitating lateral movement in networks.Tue, 10 Mar 2026 20:12:12 GMTFortinetFortiGateNgfwCredential TheftFortioshttps://runtimerebel.com/blog/cyberstrikeai-exploitation-ai-tools-targeting-fortinet-firewallshttps://runtimerebel.com/blog/cyberstrikeai-exploitation-ai-tools-targeting-fortinet-firewallsThreat actors are repurposing CyberStrikeAI to automate reconnaissance and exploit critical vulnerabilities in Fortinet FortiGate firewalls and edge devices.Tue, 03 Mar 2026 00:36:03 GMTCyberStrikeAIFortinetCVE-2024-21762AI Powered AttacksReconnaissancehttps://runtimerebel.com/blog/automated-exploitation-analysis-ai-assisted-breach-of-fortigate-infrastructurehttps://runtimerebel.com/blog/automated-exploitation-analysis-ai-assisted-breach-of-fortigate-infrastructureAmazon threat intelligence identifies a high-velocity campaign leveraging LLM automation to compromise over 600 FortiGate firewalls across 55 countries in a five-week…Mon, 23 Feb 2026 05:33:11 GMTFortinetAI ThreatsExploitationAutomationRussian Nexus